OverTheWire-Bandit

Bandit

https://overthewire.org/wargames/bandit/

bandit前33关主要包含以下知识点：

• 读文件（~:bandit12）：文件名有-、有空格；搜索特定大小、人类可读文件；文件字符串排序、base64解密、字符变换；文件解压。

• 网络连接（bandit13:bandit20）：private key ssh登录、ssh登录执行命令；nc连接与监听；ssl加密连接；namp扫描；setuid程序用户提权。

• 定时任务（bandit21:bandit23）：阅读和写简单shell脚本

• python socket连接扫描端口（bandit24）

• vim打开文件、shell（bandit25:bandit26）

• git使用（bandit27:bandit31）

• $0（bandit32）

本文只包含主要操作，不包含完整过程。

1.bandit2 文件名中有-

需要说明-文件所在目录

读 ./-

2.bandit3 文件名中有空格

写$ touch'firstname secondname'
读cat 'linoxide docs'或cat file\ name\ with\ spaces

3.bandit4 寻找当前列表中人类可读的文件

xargs file对上一步得到的每个文件运行file命令

find . -type f | xargs file | grep text

4.bandit5

• human-readable
• 1033 bytes in size
• not executable

find . -size 1033c  -not -executable;

5.bandit6

• owned by user bandit7
• owned by group bandit6
• 33 bytes in size

find . -size 33c -group bandit6 -user bandit7

6.bandit7

grep "millionth" data.txt
cat data.txt | grep "millionth"

7.bandit8

The password for the next level is stored in the file data.txt and is the only line of text that occurs only once.

sort data.txt | uniq -u

8.bandit9

The password for the next level is stored in the file data.txt in one of the few human-readable strings, preceded by several ‘=’ characters.

strings data.txt | grep -E "=+"

9.bandit10

The password for the next level is stored in the file data.txt, which contains base64 encoded data.

cat data.txt | base64 --decode

10.bandit11

The password for the next level is stored in the file data.txt, where all lowercase (a-z) and uppercase (A-Z) letters have been rotated by 13 positions

cat data.txt | tr 'n-za-mN-ZA-M' 'a-zA-Z'

11.bandit12

The password for the next level is stored in the file data.txt, which is a hexdump of a file that has been repeatedly compressed.

其中一部分解压命令
mv data data2.gz
gzip -d data2.gz
bzip2 -d data3.bz
tar -xf data5.tar

8ZjyCRiBWFYkneahHwxCv3wb2a1ORpYL

12.bandit13

The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private